6cd7360ebe700d2755abf632345779ef3a14f0487b0c03b938193b2adcf7cd62

Analysis

max time kernel
119s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 09:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ee239344667b435a948b2406b3a95b0N.exe
Size

40KB
MD5

1ee239344667b435a948b2406b3a95b0
SHA1

57e42024afe534fe1fd9cf376bc1498862a1f493
SHA256

6cd7360ebe700d2755abf632345779ef3a14f0487b0c03b938193b2adcf7cd62
SHA512

c3e0262747a84007e297d50ce67f6aa05819944c7e976e9f7a1f68d5985d7029572118efc5dd6325f3e660d5bb06f2badf04c8e5199c1c655d292a15f6347fdf
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9nT4PCs2B24PCs2BL27SKNx27SKNz:CTW7JJ7Tx4PN54PNg

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4654) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2656-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000b0000000233dc-2.dat	upx
behavioral2/files/0x0014000000022936-6.dat	upx
behavioral2/memory/2656-928-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ppd.xrm-ms.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\ARROW.WAV.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\jvm.dll.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ppd.xrm-ms.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-pl.xrm-ms.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINSHELL.DLL.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Queryable.dll.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-80.png.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\WindowsAccessBridge-64.dll.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ppd.xrm-ms.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-80.png.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\msipc.dll.mui.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tools.dll.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsBase.resources.dll.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationTypes.dll.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.dll.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationUI.resources.dll.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Xml.dll.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Design.resources.dll.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ppd.xrm-ms.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul-oob.xrm-ms.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-100.png.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Cng.dll.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Permissions.dll.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\resources.pak.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-oob.xrm-ms.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.dll.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClient.resources.dll.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr.jar.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Primitives.dll.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\sound.properties.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ul-oob.xrm-ms.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-phn.xrm-ms.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-140.png.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Design.resources.dll.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MYSL.ICO.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Encoding.dll.tmp	1ee239344667b435a948b2406b3a95b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md.tmp	1ee239344667b435a948b2406b3a95b0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1ee239344667b435a948b2406b3a95b0N.exe

C:\Users\Admin\AppData\Local\Temp\1ee239344667b435a948b2406b3a95b0N.exe
"C:\Users\Admin\AppData\Local\Temp\1ee239344667b435a948b2406b3a95b0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
40KB

MD5
ff59fe9fc31b1015996c556f60608445

SHA1
ff48cb7f76936f4702d8c139cb73543b0c3a5937

SHA256
b9dc16c7a5e893bbb84a31066bf5163104e05232475a2ee187e765825829562f

SHA512
0e0d443fd7ed848463a152d31c247f0ec24da0ad96561ecfa84e47d9bcb409df532d8e8d7bedb8e4f45a96e2ed7fd8e6fa9afd6fe4c71ceefb537c8bdb7df3c5

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
139KB

MD5
65dc01b863b1d404292217e29138d279

SHA1
b3ed01161cdd89364b8accc7403893f6e06b8f52

SHA256
86f4f9f1112657771832fba0bbcbaa11c0f9e2246ab538741e5b1ec50112766b

SHA512
5e712dd227c929ea17bfcfa6403199d36af893c49daa98aa43aa92ab4ce24adf3553cda4bc7ac5e9cbc0f090520eedca923d3ea87eaaaa31ef5168f1542c2ea9

Download Submit
memory/2656-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2656-928-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download